Hi Guys ,
is there some kind of alert from windows performance counter system up time to see when windows server restarted just to notify or even some sory of generic dashboard of all lives windows servers
Greetings @germeister18,
You have a few options since your goal is not 100% clear. If you want to see which hosts that have Splunk forwarders haven't sent an event in X minutes, use this:
| metadata type=hosts
| convert ctime(recentTime) as "Last Time Event Indexed"
| where recentTime < now()-(60*X)
| sort -recentTime
| table host "Last Time Event Indexed"
If you set the time selector to Last 7 days, it will show all hosts that reported in the last 7 days but not in the past X minutes.
If you want the actual uptime, you'll want the Splunk Add-on for Microsoft Windows on your search head, indexers, and each host with a Splunk forwarder. You will then create an inputs.conf
in the local
directory of each forwarder (hopefully using the deployment server) which enables Windows event codes. Once that's up and working, this will be your search to get the latest uptime reported by Windows to Splunk:
index=YourIndex sourcetype="WinEventLog" EventCode=6013
| dedup host
| rex field=Message "uptime is (?<Uptime_Seconds>\d+) seconds"
| table host Uptime_Seconds
| eval Uptime_Hours = round(Uptime_Seconds/60/60)
The last option will also require the Windows add-on. You can do a similar query for EventCodes 6005, 6006, and 6008 to determine uptime yourself. Those are the Event Codes for Windows start ups, and expected and unexpected shutdowns. See here: https://answers.splunk.com/answers/143636/graphing-windows-system-from-uptime-to-downtime.html
Cheers,
Jacob